Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\smartclock.lnk
- <SYSTEM32>\tasks\smart clock
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- %PROGRAMDATA%\hdu\ivm21_protected.exe
- %PROGRAMDATA%\jablpjhfh\files\browsers\cookies\mozilla_firefox_cookies_tguexcd.txt
- %PROGRAMDATA%\knttftaue\1723651.txt
- %PROGRAMDATA%\knttftaue\43561237n.txt
- %PROGRAMDATA%\jablpjhfh\files\_info.txt
- %PROGRAMDATA%\jablpjhfh\172773668.txt
- %PROGRAMDATA%\jablpjhfh\files\_filepasswords.txt
- %PROGRAMDATA%\jablpjhfh\files\_screen.jpg
- %PROGRAMDATA%\knttftaue\files\screensh0t.jpg
- %PROGRAMDATA%\hdu\ivm22_protected.exe
- %PROGRAMDATA%\jablpjhfh\cdhqfqyjowm.zip
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %APPDATA%\kjnbds.exe
- %APPDATA%\ndfsr.exe
- %PROGRAMDATA%\vvagwpu\fjchsuw.bat
- %TEMP%\tgrfedc.txt
- %APPDATA%\smart clock\smartclock.exe
- %TEMP%\frwsrftg.txt
- %PROGRAMDATA%\jablpjhfh\files\browsers\cookies\mozilla_firefox_cookies_pudxpnc.txt
- %PROGRAMDATA%\jablpjhfh\moff.db
- %PROGRAMDATA%\jablpjhfh\mocc.db-shm
- %PROGRAMDATA%\jablpjhfh\mocc.db
- %PROGRAMDATA%\knttftaue\files\information.txt
- %PROGRAMDATA%\jablpjhfh\files\browsers\_filepasswords.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\jablpjhfh\files\browsers\_fileforms.txt
- %PROGRAMDATA%\jablpjhfh\files\browsers\_filecc.txt
- %APPDATA%\opera software\opera stable\webdatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %PROGRAMDATA%\jablpjhfh\files\browsers\_filecookies.txt
- %TEMP%\rfdc.txt
- %PROGRAMDATA%\knttftaue\nl___2020_05_25___12_30___bn5hsmdduig38k8.zip
- %APPDATA%\opera software\opera stable\cookiescopy
- %PROGRAMDATA%\knttftaue\files\forms_list.txt
- %PROGRAMDATA%\knttftaue\files\cc_list.txt
- %PROGRAMDATA%\knttftaue\files\cookies_list.txt
- %PROGRAMDATA%\knttftaue\moz_cookies.db
- %PROGRAMDATA%\knttftaue\moz_cookies.db-shm
- %PROGRAMDATA%\knttftaue\files\cookies\mozillafirefox_ggidqdz.txt
- %PROGRAMDATA%\knttftaue\moz_forms.db
- %PROGRAMDATA%\knttftaue\files\cookies\mozillafirefox_6zfhgkt.txt
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\knttftaue\files\passwords_list.txt
- %APPDATA%\tryfg.exe
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\knttftaue\moz_cookies.db
- %PROGRAMDATA%\knttftaue\1723651.txt
- %PROGRAMDATA%\hdu\ivm21_protected.exe
- %PROGRAMDATA%\jablpjhfh\moff.db
- %PROGRAMDATA%\jablpjhfh\mocc.db
- %PROGRAMDATA%\jablpjhfh\files\_screen.jpg
- %PROGRAMDATA%\jablpjhfh\files\_info.txt
- %PROGRAMDATA%\jablpjhfh\mocc.db-shm
- %PROGRAMDATA%\knttftaue\moz_cookies.db-shm
- %PROGRAMDATA%\knttftaue\files\cookies_list.txt
- %PROGRAMDATA%\knttftaue\files\cc_list.txt
- %PROGRAMDATA%\knttftaue\files\forms_list.txt
- %PROGRAMDATA%\knttftaue\files\passwords_list.txt
- %APPDATA%\opera software\opera stable\cookiescopy
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %APPDATA%\opera software\opera stable\webdatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\jablpjhfh\files\browsers\_filecc.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %PROGRAMDATA%\knttftaue\moz_forms.db
- %PROGRAMDATA%\hdu\ivm22_protected.exe
- %PROGRAMDATA%\jablpjhfh\files\browsers\_filecc.txt
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\knttftaue\files\passwords_list.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\knttftaue\files\forms_list.txt
- %PROGRAMDATA%\knttftaue\files\cc_list.txt
- %APPDATA%\opera software\opera stable\webdatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %PROGRAMDATA%\knttftaue\files\cookies_list.txt
- %APPDATA%\opera software\opera stable\cookiescopy
- %PROGRAMDATA%\knttftaue\moz_cookies.db-shm
- %PROGRAMDATA%\jablpjhfh\mocc.db-shm
- http://ip##pi.com/line
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ax###d08.top/download.php?fi########
- http://ax###d08.top/downfiles/6.exe
- http://ax###d08.top/downfiles/4.exe
- http://ip##pi.com/line/
- http://ax###d08.top/downfiles/5.exe
- http://sa###r06.top/index.php
- http://mo##a07.top/index.php
- DNS ASK ip##pi.com
- DNS ASK ip###ger.org
- DNS ASK sa###r06.top
- DNS ASK mo##a07.top
- DNS ASK ax###d08.top
- DNS ASK 2n#.co
- DNS ASK sc########-o-matic-affiliate.com
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
- '%PROGRAMDATA%\hdu\ivm21_protected.exe'
- '%PROGRAMDATA%\hdu\ivm22_protected.exe'
- '%APPDATA%\kjnbds.exe'
- '%APPDATA%\ndfsr.exe'
- '%APPDATA%\smart clock\smartclock.exe'
- '%APPDATA%\tryfg.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\JablpjhfH & timeout 1 & del /f /q "%PROGRAMDATA%\Hdu\ivm21_protected.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\KNtTFTauE & timeout 1 & del /f /q "%PROGRAMDATA%\Hdu\ivm22_protected.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\JablpjhfH & timeout 1 & del /f /q "%PROGRAMDATA%\Hdu\ivm21_protected.exe"
- '%WINDIR%\syswow64\timeout.exe' 1
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\KNtTFTauE & timeout 1 & del /f /q "%PROGRAMDATA%\Hdu\ivm22_protected.exe"